[#MAGNOLIA-2021] activation: security hole if you activate a new item - Magnolia

Details

Type: Bug
Status: Resolved
Priority: Blocker
Resolution: Fixed
Affects Version/s: 3.5.3
Fix Version/s: 3.5.4
Component/s: activation

Labels:

Description:

The url /ActivationHandler is not protected and if you activate a new item the security checks are bypassed (import)

As from 3.5.4, the default activation URL is .magnolia/activation - The old url is supported through a VirtualURI

Issue Links

relation

This issue is related to:
~~MAGNOLIA-2020~~ activation: /ActivationHandler should be /.magnolia/activation or similar

Activity

Ascending order - Click to sort in descending order

Hide

Permalink

Philipp Bracher [old account - now Philipp Bärfuss] added a comment - 24/Jan/08 2:54 PM

On 3.5 instances before 3.5.4 make sure that the url /ActivationHandler is protected (deny access to the anonymous role)

Show

Philipp Bracher [old account - now Philipp Bärfuss] added a comment - 24/Jan/08 2:54 PM On 3.5 instances before 3.5.4 make sure that the url /ActivationHandler is protected (deny access to the anonymous role)

Hide

Permalink

Grégory Joseph added a comment - 24/Jan/08 6:19 PM

please link related issues when appropriate - please use the multiple jira IDs in svn commit messages when appropriate

Show

Grégory Joseph added a comment - 24/Jan/08 6:19 PM please link related issues when appropriate - please use the multiple jira IDs in svn commit messages when appropriate

People

Assignee:

Philipp Bärfuss

Reporter:

Philipp Bärfuss
Votes:

0

Watchers:

0

Dates

Created:

24/Jan/08 2:51 PM

Updated:

17/Mar/09 7:49 PM

Resolved:

24/Jan/08 2:52 PM